6.6 KiB
Cascades — Restricted vs Non-Restricted buckets + credentials
Generated: 2026-06-04 Important on passwords: Microsoft/Entra NEVER lets you read an existing password. The only known passwords are (a) the documented caregiver bulk-creation password and (b) vaulted individual accounts. Unknowns can only be made known by RESETTING them (User Manager app) — say the word and I'll reset to a known temp.
Login-password note: the caregiver bulk password was set with ChangePasswordAtLogon = $false + PasswordNeverExpires = $true, so it is a working password, NOT a reset-at-login temp. It is the actual sign-in password (PHS pushes it to M365/Entra, so it works for Windows login, ALIS SSO, and M365).
A. RESTRICTED bucket (caregivers + medtechs) — SG-Caregivers, inside-network only, devices only
All 38 bulk-created caregivers share the working password Cascades2026! (not reset-at-login). UPN = sign-in name = required ALIS Email.
| Name | UPN / sign-in | Password |
|---|---|---|
| Agnes McFerren | a.mcferren@cascadestucson.com | Cascades2026! |
| Ashli Atwood | a.atwood@cascadestucson.com | Cascades2026! |
| Barb Johnson | b.johnson@cascadestucson.com | Cascades2026! |
| Bella Mendoza | b.mendoza@cascadestucson.com | Cascades2026! |
| Charity/Bariffa Sika | b.sika@cascadestucson.com | Cascades2026! |
| Cole Johnson | c.johnson@cascadestucson.com | Cascades2026! |
| Corey Tate | c.tate@cascadestucson.com | Cascades2026! |
| Diana Fierros | d.fierros@cascadestucson.com | Cascades2026! |
| Ederick Yuzon | e.yuzon@cascadestucson.com | Cascades2026! |
| Erica Sanchez | e.sanchez@cascadestucson.com | Cascades2026! |
| Espe/Niyonsaba Esperance | e.esperance@cascadestucson.com | Cascades2026! |
| Gina Williams | g.williams@cascadestucson.com | Cascades2026! |
| Gloria Williford | g.williford@cascadestucson.com | Cascades2026! |
| Jahmeka Clarke | j.clarke@cascadestucson.com | Cascades2026! |
| Jen/Jennifer Higdon | j.higdon@cascadestucson.com | Cascades2026! |
| Jinnelle Dittbenner | j.dittbenner@cascadestucson.com | Cascades2026! |
| Juan Andrade | j.andrade@cascadestucson.com | Cascades2026! |
| Karina Aziakpo | k.aziakpo@cascadestucson.com | Cascades2026! |
| Kasey Flores | k.flores@cascadestucson.com | Cascades2026! |
| Katrina Wyzykowski | k.wyzykowski@cascadestucson.com | Cascades2026! |
| Luke Hogan | l.hogan@cascadestucson.com | Cascades2026! |
| Luriz Fuster | l.fuster@cascadestucson.com | Cascades2026! |
| Maia Baker | m.baker@cascadestucson.com | Cascades2026! |
| Marie Kastner | m.kastner@cascadestucson.com | Cascades2026! |
| Mary Kariuki | m.kariuki@cascadestucson.com | Cascades2026! |
| Monique Lopez | m.lopez@cascadestucson.com | Cascades2026! |
| Patricia Camarena Doran | p.doran@cascadestucson.com | Cascades2026! |
| Richard Flores | r.flores@cascadestucson.com | Cascades2026! |
| Rosa Morales | r.morales@cascadestucson.com | Cascades2026! |
| Roseline Cooper | r.cooper@cascadestucson.com | Cascades2026! |
| Samuel Ramirez | s.ramirez@cascadestucson.com | Cascades2026! |
| Sandra Padilla | s.padilla@cascadestucson.com | Cascades2026! |
| Sarah Carroll | s.carroll@cascadestucson.com | Cascades2026! |
| Shontiel Nunn | s.nunn@cascadestucson.com | Cascades2026! |
| Tele Lassey-Assiakoley | t.lassey-assiakoley@cascadestucson.com | Cascades2026! |
| Thelma Abainza | t.abainza@cascadestucson.com | Cascades2026! |
| Whisper Reed | w.reed@cascadestucson.com | Cascades2026! |
| Zeke Huerta | e.huerta@cascadestucson.com | Cascades2026! |
New adds to restricted (existing accounts — password NOT known, RESET needed):
| Name | UPN | Password |
|---|---|---|
| Veronica Feller | veronica.feller@cascadestucson.com | UNKNOWN — reset needed (confirm on-site first; inventory shows PA) |
| Christine Nyanzunda | christine.nyanzunda@cascadestucson.com | UNKNOWN — reset needed; also fix directory surname typo "Nyanzuda" |
Caveat: any of the 38 who voluntarily changed their password (unlikely for shared-phone caregivers) would differ from
Cascades2026!. If a login fails, reset that one.
B. NON-RESTRICTED bucket (privileged — outside access to ALIS + M365, 2FA offsite)
NOT in SG-Caregivers. Microsoft offsite access already works (all-users-MFA, trusted-location excluded). For outside ALIS they need ALIS Email = UPN + native 2FA off.
| Name | Role | UPN | Password |
|---|---|---|---|
| Lois Lane | Health Services Dir (RN) | Lois.Lane@cascadestucson.com | Imbirowicz1$ |
| Megan Hiatt | Sales/Marketing Dir | megan.hiatt@cascadestucson.com | 4PazCas$07 |
| Ashley Jensen | Asst Exec Dir / CFO | Ashley.Jensen@cascadestucson.com | Fall2025! (local pre-domain: ScarlettSky18*) |
| Front Desk (shared) | Reception | frontdesk@cascadestucson.com | sccssccs#3 |
| Karen Rossini | Health Services Mgr (LPN) | karen.rossini@cascadestucson.com | UNKNOWN — reset if needed (ALIS SSO already working for her) |
| Christina DuPras | Resident Svcs / Admin Asst | christina.dupras@cascadestucson.com | UNKNOWN — reset needed |
| Meredith Kuhn | Executive Director | meredith.kuhn@cascadestucson.com | UNKNOWN |
| Lauren Hasselman | Business Office Mgr | lauren.hasselman@cascadestucson.com | UNKNOWN |
| Crystal Rodriguez | Sales | crystal.rodriguez@cascadestucson.com | UNKNOWN (ALIS SSO already working) |
| Shelby Trozzi | MemCare Director | (verify UPN) | UNKNOWN |
| Susan Hicks | Life Enrichment Dir | Susan.Hicks@cascadestucson.com | UNKNOWN |
| Chris Knight | CFO | chris.knight@cascadestucson.com | UNKNOWN |
| Lupe Sanchez | Housekeeping Dir | (verify UPN) | UNKNOWN |
| Alyssa Shestko | Dining Room Mgr | (verify UPN) | UNKNOWN |
Admin/break-glass (cloud-only, excluded from CA): admin@cascadestucson.com, sysadmin@cascadestucson.com (vaulted).
C. Phased testing — LIVE mechanism
- Group
SG-Caregivers-DeviceTest(db5849ec-242d-4b05-9d1b-940a830e7a60) — members are governed by the allow-list (phones + tagged devices) instead of the compliance block. - Allow-list policy
CSC - Caregivers: allow-listed devices only (TEST GROUP)(1b7fd025-...) = ENABLED, scoped to that group. - Compliance-block (
ede985e2-...) now EXCLUDES that group.
To test one caregiver: (1) match their ALIS Email = UPN; (2) add them to SG-Caregivers-DeviceTest; (3) on a tagged laptop, log into Windows/Edge with their UPN + Cascades2026!, open ALIS -> verify silent SSO; (4) verify they still work on a phone. Expand one at a time.
Full cutover (when confident): point the allow-list policy back to SG-Caregivers (all), disable the compliance block, empty/delete the test group.
Tagged devices so far: Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8. Pending (Win11 25H2): LAPTOP-8P7HDSEI, ASSISTNURSE-PC. Hybrid pending: NURSESTATION-PC.